Fix XSS vulnerability in message subject handling using Larry skin (#1488519)

2 files changed, 2 insertions, 1 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 224812948..0c3953484 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix XSS vulnerability in message subject handling using Larry skin (#1488519)
 - Fix handling of links with various URI schemes e.g. "skype:" (#1488106)
 - Fix handling of links inside PRE elements on html to text conversion
 - Fix indexing of links on html to text conversion
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 1e5dbda19..7417c6ba3 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -947,7 +947,7 @@ function rcmail_message_headers($attrib, $headers=NULL)
 
   // single header value is requested
   if (!empty($attrib['valueof']))
-    return Q($plugin['output'][$attrib['valueof']]['value'], ($hkey == 'subject' ? 'strict' : 'show'));
+    return Q($plugin['output'][$attrib['valueof']]['value'], ($attrib['valueof'] == 'subject' ? 'strict' : 'show'));
 
   // compose html table
   $table = new html_table(array('cols' => 2));